Zero Trust by Default
Every API call is verified, filtered, and logged. Nothing passes through without matching a policy. Deny by default, allow by rule.
Securing the Microsoft Graph API Gap
Microsoft Graph API is the backbone of modern enterprise productivity. It is also one of the most powerful - and least governed - attack surfaces in your tenant. GraphWarden exists to close that gap: granular control, zero-knowledge secrets, and a complete audit trail for every API call.
Why We Built GraphWarden
Microsoft Graph API is remarkable. A single endpoint that unlocks users, calendars, mail, files, Teams, and security data across an entire Microsoft 365 tenant. For developers, it is a gift. For security teams, it is a liability.
The problem is structural. Graph permissions are horizontal: granting an application User.Read.All means it can read every user, every property, with no native way to scope it down. Secrets end up hardcoded in PowerShell scripts nobody dares touch. Rotation is a multi-day project. And when the auditor asks who accesses what data, the honest answer is “we don't know.”
We built GraphWarden because we saw enterprise after enterprise struggle with the same challenges - and because Microsoft does not offer a solution. Every Graph API call should be governed, audited, and controlled. That conviction should not require rewriting your applications, retraining your teams, or hoping that a future Microsoft update eventually addresses the gap. It requires a purpose-built proxy that sits between your apps and Graph, enforces your policies, and gives you the visibility you need - today.
What We Stand For
Four principles that guide every line of code and every architectural decision.
Zero Knowledge
We never see or store your credentials, tokens, or tenant data. Real secrets live in your Azure Key Vault. The proxy never persists anything to disk.
Enterprise First
Built for scale, compliance, and real-world complexity. Multi-tenant architecture, role-based access, immutable audit logs, and on-premise deployment options.
Deploy, Don't Disrupt
Under 60 minutes to production. No code changes. No developer friction. Your apps change a URL - everything else stays the same.
A Gap Microsoft Doesn't Fill
The market for Graph API governance is massive, urgent, and unaddressed.
400M+
Active M365 Users
Billions
Daily Graph API Calls
0
Native Granular Governance Solutions
Every organization running Microsoft 365 relies on Graph API - often without realizing how many applications, scripts, and integrations are making calls against their tenant. The permissions model is all-or-nothing. The audit trail is fragmented. And the regulatory pressure is only growing.
GDPR, SOC 2, HIPAA, and Loi 25 all demand that organizations demonstrate control over personal data access. Graph API - where that data lives - has no native solution for granular, application-level governance. Microsoft Conditional Access policies stop at the identity layer. They do not address which properties an app can read, which objects it can see, or what happens to the data after it leaves Graph.
This is not a niche problem. It is a horizontal gap that affects every enterprise in every regulated industry. GraphWarden is purpose-built to fill it - and we are the first to do so.
Built for Enterprise
Trust signals that matter when security is the product.
Multi-Tenant Architecture
Manage hundreds of organizations from a single control plane. Each tenant runs its own proxy agent with isolated policies.
Role-Based Access Control
Granular dashboard permissions. Admins define rules, operators monitor, auditors review - each with the access they need.
Immutable Audit Logs
Every call logged with full context: app identity, endpoint, matched rule, objects returned versus filtered. Export-ready for compliance.
Azure Key Vault Integration
Real Graph credentials live in Key Vault. Apps authenticate with revocable proxy credentials. Secrets are never exposed or hardcoded.
HMAC-Authenticated APIs
Every proxy request is cryptographically signed. No bearer tokens in transit. Replay attacks are blocked by design.
On-Premise Deployment
The proxy agent runs in your environment as a Windows service. Your data never leaves your network. Zero external dependencies.
Our mission
Make Microsoft Graph governable at runtime — not after the fact. Every enterprise that relies on M365 depends on Graph. Very few can tell you which app read which property yesterday. We are building the runtime policy layer that closes that gap, without asking you to rewrite applications or trust a vendor with your tenant credentials.
The team
GraphWarden is built by a small, focused team with deep Microsoft 365 and enterprise-security experience. We are based in Montreal, Canada, and we are hiring deliberately.
Where we are today
GraphWarden is in a design partners program. We are working directly with a small number of organizations to validate rulesets, audit flows, and deployment patterns against real M365 tenants. If you have a concrete Graph governance problem, we want to hear about it.
Apply to the design partners programJoin the GraphWarden Beta
We are working with a select group of design partners to shape the future of Graph API governance. If your organization manages Microsoft 365 at scale, we want to hear from you.
Beta · Now Accepting PartnersOr read the documentation to learn more.